Chief Information Security Officer (CISO)

ursamajor; Longmont (CO); On-site; USD 180,000 - 280,000; Full time

Job summary

Ursa Major seeks an executive-level Chief Information Security Officer (CISO w/ clearance) to own enterprise cybersecurity across multi-site engineering, manufacturing, and classified programs in the United States. You will set risk management strategy, drive RMF/NIST alignment, and oversee CMMC 2.0 readiness while protecting critical IP and enabling growth.

You will partner with the Facility Security Officer and leadership to forge strong cyber defenses, governance, and incident response plans,

Qualifications

• 12+ years in cybersecurity, information assurance, and secure systems architecture, with 5+ years in senior leadership in A&D.
• Active U.S. Government Security Clearance (Top Secret preferred with SCI/SAP eligibility).
• Track record partnering with FSOs, government AOs, and program leadership to secure facility authorizations and ATOs.
• Deep mastery of federal security standards including NIST SP 800-171, CMMC Level 2, NIST SP 800-53, RMF.

Responsibilities

• Define and execute enterprise cybersecurity and information assurance strategy across corporate, manufacturing, engineering, and classified environments.
• Build and mentor a cybersecurity engineering and compliance team with cross-functional partnership.
• Advance and accredit CMMC Level 2 / NIST SP 800-171 architectures, ensuring secure data flow across sites.
• Lead digital architecture, authorization packages, and monitoring of classified systems (Secret/SAP) per RMF, JSIG, and NIST SP 800-53.
• Establish an enterprise cyber risk register with clear metrics for leadership and the Board.
• Embed Zero Trust, identity governance, and endpoint protection on shop floors, test stands, and cloud environments.
• Collaborate with FSO and security teams to unify cyber with physical enclave controls and cleared governance.
• Serve as executive authority for cyber assessments, DCSA reviews, audits, and CMMC assessments (C3PAO).
• Develop governance incl. incident response, third-party risk, SEC disclosures, and ITGCs.
• Act as escalation authority for incidents and crisis communications.

Skills

Cybersecurity

Information assurance

Security architecture

Senior leadership

A&D sector

Tools

RMF

JSIG

NIST SP 800-53

DCSA standards

Job description

The future of aerospace and defense starts here.

Ursa Major was founded to revolutionize how America and its allies access and apply high-performance propulsion, from hypersonics to solid rocket motors, satellite maneuvering and launch. We design and deliver propulsion and defense systems that solve the most urgent and critical national security demands.

Our mission requires an extraordinary team, specifically one that will mold tomorrow's critical technologies while deploying today's best. We are an intrinsically motivated organization with a passion for solving complex technical problems and empowering each other every day, knowing that there is always room for growth.

About The Role

Ursa Major is seeking an executive technology leader to serve as our Chief Information Security Officer (CISO w/ clearance) . Reporting to the executive leadership team, the CISO will establish enterprise-wide information security ownership across our multi-site engineering, manufacturing, and test facilities. Working in direct, strategic lockstep with our Facility Security Officer (FSO), who leads personnel clearances, physical security, and overall NISPOM facility compliance, the CISO serves as the ultimate authority for digital, technical, and operational cybersecurity.

We are not looking for an administrator who leads from behind a desk or relies on enterprise bureaucracy. We need a builder who leads from the front-an executive with deep roots in Aerospace & Defense (A&D) who knows what mature security infrastructure looks like and possesses the hands-on drive to build, scale, and mature our systems from the ground up.

Sitting at the intersection of defense compliance, manufacturing velocity, and enterprise IT, you will own the overarching risk management strategy for both unclassified and classified programs. You will champion our hybrid CMMC Level 2 enclave expansion, govern the technical architecture of classified defense enclaves (Secret / SAP), protect critical Intellectual Property, and establish the cyber risk governance required for a high-growth defense firm preparing for public-company operations.

Responsibilities

• Define and execute Ursa Major's enterprise cybersecurity and information assurance strategy across all corporate, manufacturing, engineering, and classified program environments.
• Lead from the front to build, mentor, and inspire a world-class cybersecurity engineering and compliance team, fostering a culture of operational enablement, technical rigor, and deep cross-functional partnership.
• Direct the continuous advancement and accreditation of our CMMC Level 2 / NIST SP 800-171 architecture, ensuring Controlled Unclassified Information (CUI) and defense technical data flow securely across multi-site operations without impeding engineering velocity.
• In close partnership with the FSO and program security, lead the digital architecture, technical authorization packages, and continuous monitoring of classified information systems (Secret, Top Secret, and Special Access Programs) in strict alignment with RMF, JSIG, NIST SP 800-53, and DCSA standards.
• Establish an enterprise cyber risk register, translating technical vulnerabilities into clear operational and business risk metrics for executive leadership and the Board of Directors.
• Partner closely with IT, DevOps, and Digital Manufacturing to embed Zero Trust network segmentation, identity governance (Entra ID), and robust endpoint detection into physical shop floors, test stands, and cloud environments.
• Establish a collaborative, locked-in operating rhythm with the FSO and physical security teams to unify technical cyber defenses with physical enclave controls, COMSEC, and cleared personnel governance.
• Serve as the executive authority for technical and cyber assessments, partnering with the FSO on DCSA security reviews, customer audits, DCMA evaluations, and third-party CMMC assessments (C3PAO).
• Build public-company-grade cybersecurity governance, including incident response playbooks, third-party vendor risk management (TPRM), SEC disclosure readiness, and SOX IT General Controls (ITGC).
• Act as the senior escalation authority for incident handling, crisis communications, threat intelligence integration, and technical remediation.

Minimum Qualifications

• 12+ years of progressive experience in cybersecurity, information assurance, and secure systems architecture, with at least 5+ years in senior leadership or technical management roles within the Aerospace & Defense (A&D) sector.
• Active U.S. Government Security Clearance (Top Secret required, with active or recent SCI/SAP eligibility preferred).
• Demonstrated track record of partnering successfully with Facility Security Officers (FSOs), government Authorizing Officials (AOs), and program leadership to secure facility authorizations and system ATOs.
• Deep technical and regulatory mastery of federal security standards, including NIST SP 800-171, CMMC Level 2, NIST SP 800-53, Risk Managem